Extracted

• • Target
    DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe
  • Size 606KB
  • SHA256 93e9e99eb9d74a0cfa3cec7fea4a663b9ad5e8fe4e6ba38bf597a902ce592e1e
  • MD5 bd8229dde5d5dfd5bded095911b835ca
  • SHA1 c1fdb6b6829afe4f2bb9ddac12cb384bb2dff286
  • SHA512 9d945c7baa4fc8a83323e72e324d166d18af7c9d1914906ba49ad27813cc4360d7f979c2c6b594199ffef105adbc4dc1708eee34c51ccba9877f898c87db9f0c
  • SSDEEP 12288:Xq2PIZimzX1v9jA6FAOlyQMjcK6g+xHBMD1n+RuGJ4gge707kyLL1XXMQ:YT1v5hFllS4K6hxhMDSuRgghoyLJnM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookt36tratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2